fullcourtdefense-cli 1.25.2 → 1.25.4

package/dist/commands/cmdGuard.js

@@ -118,7 +118,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Execution view (aligned with the CLI's stripInertDataSegments): commit messages, issue/PR bodies, and`,
+        `// here-strings/heredocs are DATA — inert unless the line can feed an interpreter or the region interpolates.`,
+        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]*\`/;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');o=o.replace(/((?:^|\\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\\s*)("(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*')/gi,(w,f,q)=>q[0]==="'"?f+' fcd_inert_data ':K.test(q)?w:f+' fcd_inert_data ');return o;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,

package/dist/commands/daemon.d.ts

@@ -38,14 +38,27 @@ export type TaskLogonType = 'S4U' | 'InteractiveToken';
 export declare function taskUserId(): string;
 /** Local wall-clock timestamp (no ms, no tz) as Task Scheduler expects. */
 export declare function taskLocalTimestamp(date: Date): string;
+/** Full path to conhost.exe — the signed Windows binary whose `--headless`
+ *  flag hosts a console child on a hidden pseudoconsole (no window, ever). */
+export declare function conhostPath(): string;
 /**
  * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
  *
  * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
  * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
  *                   time trigger for the 5-minute watchdog.
- * @param logonType  S4U (windowless, needs elevation to register) or
- *                   InteractiveToken (registers unelevated, may flash).
+ * @param logonType  S4U (windowless by session, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated — the action is
+ *                   wrapped in `conhost --headless` so it is ALSO windowless).
+ *
+ * Why the conhost wrapper: an InteractiveToken task runs console apps on the
+ * interactive desktop — a visible window on EVERY trigger (the "console flash
+ * every 5 minutes" complaint). Current Windows builds deny S4U registration to
+ * everyone except the task's own user running elevated (even SYSTEM gets
+ * Access denied — verified empirically; the updater's SYSTEM repair pass can
+ * no longer fix it). `conhost.exe --headless` sidesteps the whole fight: the
+ * child gets a hidden pseudoconsole, no window ever exists, registration
+ * stays unelevated, and no script host is involved (Defender-safe).
  */
 export declare function buildTaskXml(command: string, triggers: string, logonType?: TaskLogonType): string;
 /**
@@ -74,6 +87,11 @@ export declare function windowsTaskReferencesScriptHost(taskName: string): boole
  *  the 1.22.1 window-flash bug (console window on every trigger). Migration
  *  trigger for the windowless S4U principal. */
 export declare function windowsTaskRunsInteractive(taskName: string): boolean;
+/** True when triggering the task would open a VISIBLE console window:
+ *  InteractiveToken principal AND a bare console action (not wrapped in
+ *  `conhost --headless`). This — not the principal alone — is the flash
+ *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
+export declare function windowsTaskRunsVisibly(taskName: string): boolean;
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;

package/dist/commands/daemon.js

@@ -39,11 +39,13 @@ exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
 exports.cliVersion = cliVersion;
 exports.taskUserId = taskUserId;
 exports.taskLocalTimestamp = taskLocalTimestamp;
+exports.conhostPath = conhostPath;
 exports.buildTaskXml = buildTaskXml;
 exports.buildTaskXmlVariants = buildTaskXmlVariants;
 exports.registerHiddenTask = registerHiddenTask;
 exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
 exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
+exports.windowsTaskRunsVisibly = windowsTaskRunsVisibly;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
@@ -1261,23 +1263,41 @@ function taskLocalTimestamp(date) {
     return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
         `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
 }
+/** Full path to conhost.exe — the signed Windows binary whose `--headless`
+ *  flag hosts a console child on a hidden pseudoconsole (no window, ever). */
+function conhostPath() {
+    return path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'conhost.exe');
+}
 /**
  * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
  *
  * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
  * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
  *                   time trigger for the 5-minute watchdog.
- * @param logonType  S4U (windowless, needs elevation to register) or
- *                   InteractiveToken (registers unelevated, may flash).
+ * @param logonType  S4U (windowless by session, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated — the action is
+ *                   wrapped in `conhost --headless` so it is ALSO windowless).
+ *
+ * Why the conhost wrapper: an InteractiveToken task runs console apps on the
+ * interactive desktop — a visible window on EVERY trigger (the "console flash
+ * every 5 minutes" complaint). Current Windows builds deny S4U registration to
+ * everyone except the task's own user running elevated (even SYSTEM gets
+ * Access denied — verified empirically; the updater's SYSTEM repair pass can
+ * no longer fix it). `conhost.exe --headless` sidesteps the whole fight: the
+ * child gets a hidden pseudoconsole, no window ever exists, registration
+ * stays unelevated, and no script host is involved (Defender-safe).
  */
 function buildTaskXml(command, triggers, logonType = 'S4U') {
     const userId = xmlEscape(taskUserId());
-    const nodeExe = xmlEscape(process.execPath);
-    const args = xmlEscape(`"${cliEntry()}" ${command}`);
+    const headless = logonType === 'InteractiveToken';
+    const execCommand = headless ? xmlEscape(conhostPath()) : xmlEscape(process.execPath);
+    const args = headless
+        ? xmlEscape(`--headless "${process.execPath}" "${cliEntry()}" ${command}`)
+        : xmlEscape(`"${cliEntry()}" ${command}`);
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
-    <Description>FullCourtDefense ${xmlEscape(command)} — runs node directly, windowless, no script host.</Description>
+    <Description>FullCourtDefense ${xmlEscape(command)} — runs node ${headless ? 'under conhost --headless' : 'directly'}, windowless, no script host.</Description>
   </RegistrationInfo>
   <Triggers>
 ${triggers}
@@ -1307,7 +1327,7 @@ ${triggers}
   </Settings>
   <Actions Context="Author">
     <Exec>
-      <Command>${nodeExe}</Command>
+      <Command>${execCommand}</Command>
       <Arguments>${args}</Arguments>
     </Exec>
   </Actions>
@@ -1383,10 +1403,10 @@ function registerHiddenTask(taskName, xml, command, scheduleArgs) {
         }
         catch { /* try next variant, then /TR */ }
     }
-    // Fallback: node directly via /TR (no wscript, no VBS). node/CLI may live
-    // under a path with spaces (Program Files), so quote each and let schtasks
-    // pass the whole /TR string through.
-    const tr = `"${process.execPath}" "${cliEntry()}" ${command}`;
+    // Fallback: node via /TR under conhost --headless (no wscript, no VBS, no
+    // window). node/CLI may live under a path with spaces (Program Files), so
+    // quote each and let schtasks pass the whole /TR string through.
+    const tr = `${conhostPath()} --headless "${process.execPath}" "${cliEntry()}" ${command}`;
     const fallback = (0, child_process_1.spawnSync)('schtasks', [
         '/Create', '/TN', taskName, '/TR', tr, ...scheduleArgs, '/F',
     ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
@@ -1421,16 +1441,30 @@ function windowsTaskReferencesScriptHost(taskName) {
  *  the 1.22.1 window-flash bug (console window on every trigger). Migration
  *  trigger for the windowless S4U principal. */
 function windowsTaskRunsInteractive(taskName) {
+    return windowsTaskXmlState(taskName).interactive;
+}
+/** True when triggering the task would open a VISIBLE console window:
+ *  InteractiveToken principal AND a bare console action (not wrapped in
+ *  `conhost --headless`). This — not the principal alone — is the flash
+ *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
+function windowsTaskRunsVisibly(taskName) {
+    const state = windowsTaskXmlState(taskName);
+    return state.interactive && !state.headless;
+}
+function windowsTaskXmlState(taskName) {
     try {
         const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
             encoding: 'utf8', windowsHide: true, timeout: 10_000,
         });
         if (query.status !== 0 || typeof query.stdout !== 'string')
-            return false;
-        return /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout);
+            return { interactive: false, headless: false };
+        return {
+            interactive: /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout),
+            headless: /conhost(\.exe)?<\/Command>[\s\S]*?--headless/i.test(query.stdout),
+        };
     }
     catch {
-        return false;
+        return { interactive: false, headless: false };
     }
 }
 /**
@@ -1456,7 +1490,38 @@ function upgradeTaskWindowless(taskName, s4uXml, logFn) {
             logFn(`Self-heal: "${taskName}" migrated to the windowless S4U principal (no more console-window flash).`);
             return true;
         }
-        logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — asking the elevated updater task to do it.`);
+        logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs same-user elevation) — re-registering it headless instead.`);
+        return false;
+    }
+    catch {
+        return false; /* keep the existing working task */
+    }
+}
+/**
+ * Re-register an InteractiveToken task with its action wrapped in
+ * `conhost --headless` — windowless without touching the principal, so the
+ * SAME user can do it unelevated (unlike S4U, which current Windows only
+ * grants to the task's own user running elevated — even SYSTEM is denied).
+ * Returns true when the task no longer opens a window on trigger.
+ */
+function rewrapTaskHeadless(taskName, interactiveHeadlessXml, logFn) {
+    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    const dir = path.join(base, 'FullCourtDefense');
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch { /* ignore */ }
+    const xmlPath = path.join(dir, `${taskName.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`);
+    try {
+        fs.writeFileSync(xmlPath, `\ufeff${interactiveHeadlessXml}`, 'utf16le');
+        const created = (0, child_process_1.spawnSync)('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], {
+            stdio: 'ignore', windowsHide: true, timeout: 20_000,
+        });
+        if (created.status === 0) {
+            logFn(`Self-heal: "${taskName}" re-registered with a conhost --headless action (windowless from its next trigger).`);
+            return true;
+        }
+        logFn(`Self-heal: could not re-register "${taskName}" headless — asking the elevated updater task to migrate it.`);
         return false;
     }
     catch {
@@ -1478,14 +1543,20 @@ let updaterMigrationKicked = false;
 function kickUpdaterTaskForMigration(logFn) {
     if (updaterMigrationKicked)
         return;
-    updaterMigrationKicked = true;
     try {
         const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', selfUpdate_1.MSI_UPDATER_TASK_NAME], {
             stdio: 'ignore', windowsHide: true, timeout: 20_000,
         });
-        logFn(run.status === 0
-            ? `Self-heal: elevated updater task triggered — it migrates the tasks to S4U now (windowless within a minute).`
-            : `Self-heal: updater task unavailable for the S4U migration — its next daily run (03:07) will migrate instead.`);
+        // Latch ONLY on a successful kick. On a fresh MSI install the daemon can
+        // boot before the SYSTEM updater task exists — burning the one-shot latch
+        // on that failure left the machine flashing until the 03:07 daily run.
+        if (run.status === 0) {
+            updaterMigrationKicked = true;
+            logFn(`Self-heal: elevated updater task triggered — its repair pass migrates the tasks now.`);
+        }
+        else {
+            logFn(`Self-heal: updater task unavailable for the task migration — will retry on a later self-heal; the daily run (03:07) is the backstop.`);
+        }
     }
     catch { /* best-effort — the daily schedule remains the backstop */ }
 }
@@ -1528,21 +1599,20 @@ function startDaemonNowWindows(viaTask = false) {
         }
     }
     catch { /* not running */ }
-    if (viaTask && !windowsTaskRunsInteractive(TASK_NAME)) {
+    if (viaTask && !windowsTaskRunsVisibly(TASK_NAME)) {
         // Start through the scheduled task so the daemon runs with the task's
         // LIMITED (non-elevated) token. Launching directly from an elevated MSI
         // custom action would leave an elevated daemon that a normal-user CLI can
         // never stop or supersede.
         //
-        // ONLY when the task is windowless (S4U): starting an InteractiveToken
-        // task runs node.exe on the interactive desktop, and since the daemon
-        // never exits, that console window stays OPEN on the user's screen — the
-        // "open console at the end of installation" customer complaint. Fresh
-        // unelevated installs register InteractiveToken (S4U needs elevation), so
-        // those take the hidden WMI path below instead; the MSI's SYSTEM-context
-        // migration flips the task to S4U moments later, and every subsequent
-        // task start is windowless. Elevation is not a concern here: when the
-        // caller IS elevated, S4U registration succeeded and this branch is taken.
+        // ONLY when the task cannot open a window (S4U principal, or an
+        // InteractiveToken action wrapped in conhost --headless): starting a
+        // bare-console InteractiveToken task runs node.exe on the interactive
+        // desktop, and since the daemon never exits, that console window stays
+        // OPEN on the user's screen — the "open console at the end of
+        // installation" customer complaint. A visibly-registered task takes the
+        // hidden WMI path below instead; self-heal re-registers it headless on
+        // the next daemon boot.
         const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
         if (run.status === 0)
             return;
@@ -1567,11 +1637,11 @@ function installWindows() {
     let ok = taskOk;
     if (!ok) {
         // Fallback: per-user Run key — no elevation needed, runs at every logon.
-        // node.exe directly (no wscript). May flash briefly at logon in this rare
-        // fallback, but carries no script-host persistence fingerprint.
+        // conhost --headless keeps the logon launch windowless (no wscript, no
+        // script-host persistence fingerprint).
         const reg = (0, child_process_1.spawnSync)('reg', [
             'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-            '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
+            '/d', `"${conhostPath()}" --headless "${process.execPath}" "${cliEntry()}" daemon`, '/f',
         ], { stdio: 'ignore', windowsHide: true });
         ok = reg.status === 0;
     }
@@ -1616,7 +1686,7 @@ function ensureWindowsAutostartHealthy(logFn) {
             if (!created) {
                 (0, child_process_1.spawnSync)('reg', [
                     'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-                    '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
+                    '/d', `"${conhostPath()}" --headless "${process.execPath}" "${cliEntry()}" daemon`, '/f',
                 ], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
             }
             if (daemonTask.status !== 0)
@@ -1630,17 +1700,24 @@ function ensureWindowsAutostartHealthy(logFn) {
                 logFn('Self-heal: could not (re)create the watchdog task — daemon revival relies on logon autostart only.');
             }
         }
-        // Migration (1.22.1 -> 1.22.2): InteractiveToken tasks flash a console
-        // window on every trigger. Upgrade healthy existing tasks to S4U; S4U-only
-        // attempt so a denied re-registration never breaks a working task. When
-        // unelevated self-heal cannot flip them, kick the SYSTEM updater task
-        // once — its repair pass migrates with real elevation (1.22.7).
+        // Migration: an InteractiveToken task with a bare console action flashes a
+        // window on every trigger. Try the S4U principal first (works when this
+        // daemon happens to be elevated — current Windows denies S4U registration
+        // to everyone else, INCLUDING SYSTEM, so the updater usually cannot help).
+        // When S4U is denied, re-register the task as InteractiveToken with the
+        // action wrapped in `conhost --headless` — same-user unelevated
+        // registration always works and is just as windowless. The updater kick
+        // stays as the final backstop for machines where even that failed.
         let migrationDenied = false;
-        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsInteractive(TASK_NAME)) {
-            migrationDenied = !upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn) || migrationDenied;
+        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsVisibly(TASK_NAME)) {
+            const daemonXml = buildDaemonTaskXml();
+            migrationDenied = !(upgradeTaskWindowless(TASK_NAME, daemonXml[0], logFn)
+                || rewrapTaskHeadless(TASK_NAME, daemonXml[1], logFn)) || migrationDenied;
         }
-        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsInteractive(WATCHDOG_TASK_NAME)) {
-            migrationDenied = !upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn) || migrationDenied;
+        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsVisibly(WATCHDOG_TASK_NAME)) {
+            const watchdogXml = buildWatchdogTaskXml();
+            migrationDenied = !(upgradeTaskWindowless(WATCHDOG_TASK_NAME, watchdogXml[0], logFn)
+                || rewrapTaskHeadless(WATCHDOG_TASK_NAME, watchdogXml[1], logFn)) || migrationDenied;
         }
         if (migrationDenied)
             kickUpdaterTaskForMigration(logFn);
@@ -1648,9 +1725,9 @@ function ensureWindowsAutostartHealthy(logFn) {
         if (windowsRunKeyReferencesScriptHost()) {
             (0, child_process_1.spawnSync)('reg', [
                 'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-                '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
+                '/d', `"${conhostPath()}" --headless "${process.execPath}" "${cliEntry()}" daemon`, '/f',
             ], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
-            logFn('Self-heal: rewrote legacy wscript Run-key entry to run node directly.');
+            logFn('Self-heal: rewrote legacy wscript Run-key entry to run node headless.');
         }
         removeLegacyWindowsLaunchers();
     }

package/dist/commands/deterministicGuard.d.ts

@@ -55,6 +55,7 @@ export interface LocalSafetyScanOptions {
      */
     trustedScriptPaths?: string[];
 }
+export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicPrompt(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
 exports.scanDeterministicPrompt = scanDeterministicPrompt;
@@ -615,10 +616,12 @@ function credentialCommandReason(value) {
 function destructiveCommandReason(value) {
     return matchCommand(value, (text, lower) => {
         // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`), and the target
-        // may be the root `/`, the root wildcard `/*`, or a bare `*`.
-        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        // may be the root `/`, the root wildcard `/*`, or a bare `*`. Terminators
+        // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
+        // outer command — is caught too.
+        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
         // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
         // is independent (`/s /q` and `/q /s` both wipe), and the dequoted variant
@@ -779,13 +782,55 @@ function isSensitivePathContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
     return /(?:path|file|filename|dir|directory|target|source|src|dest|location|glob|pattern|uri|url)/i.test(lastKey);
 }
-function scanTextValue(toolName, value, options) {
-    const honeypot = honeypotTouch(value, options);
+// ---- execution view: message/document DATA inside a command is inert ---------
+// Kills the "wrote ABOUT a dangerous command" FP class: commit messages,
+// issue/PR bodies, here-strings, doc heredocs quoting `terraform destroy` or
+// `rm -rf /` are data, not execution. Safety invariants:
+//   1. NOTHING is stripped when the text can feed an interpreter (| sh, iex,
+//      eval, xargs, base64 -d, -EncodedCommand, FromBase64String) — data that
+//      flows into an interpreter IS execution.
+//   2. A region containing $( ) or `…` pairs is kept — interpolation executes
+//      BEFORE the outer command.
+//   3. Secret-literal rules and honeypot/custom rules never use this view —
+//      a token pasted into a commit message still leaks.
+const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b/i;
+const INTERPOLATES = /\$\(|`[^`]*`/;
+const INERT_DATA = ' fcd_inert_data ';
+const TEXT_SINK_FLAG_ARG = /((?:^|\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/gi;
+function stripInertDataSegments(text) {
+    if (DATA_TO_INTERPRETER.test(text))
+        return text;
+    let out = text;
+    // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
+    out = out.replace(/@'[\s\S]*?'@/g, INERT_DATA);
+    out = out.replace(/@"[\s\S]*?"@/g, m => (m.includes('$(') ? m : INERT_DATA));
+    // POSIX heredocs: quoted delimiter (<<'EOF') is literal; unquoted interpolates.
+    out = out.replace(/<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)/g, INERT_DATA);
+    out = out.replace(/<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)/g, m => (INTERPOLATES.test(m) ? m : INERT_DATA));
+    // Quoted message/text-flag arguments (commit messages, issue/PR bodies…).
+    out = out.replace(TEXT_SINK_FLAG_ARG, (whole, flag, quoted) => {
+        if (quoted.startsWith("'"))
+            return flag + INERT_DATA;
+        return INTERPOLATES.test(quoted) ? whole : flag + INERT_DATA;
+    });
+    return out;
+}
+function scanTextValue(toolName, rawValue, options) {
+    // Honeypot decoys and org custom patterns scan the RAW value: a decoy path
+    // even inside message data is exfiltration staging, and custom rules define
+    // their own scope.
+    const honeypot = honeypotTouch(rawValue, options);
     if (honeypot)
         return honeypot;
-    const custom = customBlock(value, options);
+    const custom = customBlock(rawValue, options);
     if (custom)
         return custom;
+    // Every rule below asks "can this text ACT?" — so it sees the execution
+    // view: quoted message/document data (commit -m, issue --body, here-strings,
+    // heredocs) is inert unless it can flow into an interpreter (see
+    // stripInertDataSegments invariants). This is the generic FP guard for
+    // "wrote ABOUT a dangerous command" vs "ran one".
+    const value = stripInertDataSegments(rawValue);
     // NOTE: a disabled item must FALL THROUGH to the later rules, not end the
     // scan — otherwise turning off (or gating) a path rule would mask a real
     // reverse shell / destructive command in the same value.

package/dist/commands/posixShellGuard.js

@@ -104,7 +104,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `const BLOCK_CODE=${BLOCK_CODE};`,
         `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Execution view (aligned with the CLI's stripInertDataSegments): commit messages, issue/PR bodies, and`,
+        `// here-strings/heredocs are DATA — inert unless the line can feed an interpreter or the region interpolates.`,
+        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]*\`/;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');o=o.replace(/((?:^|\\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\\s*)("(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*')/gi,(w,f,q)=>q[0]==="'"?f+' fcd_inert_data ':K.test(q)?w:f+' fcd_inert_data ');return o;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
         `let argv=process.argv.slice(2);if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,

package/dist/commands/shellGuard.js

@@ -485,14 +485,42 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  }`,
         `} catch { $global:FcdGuardRules = @() }`,
         ``,
+        `# Execution view (aligned with the CLI's stripInertDataSegments): message/`,
+        `# document DATA inside a command is inert — commit messages, issue/PR bodies,`,
+        `# here-strings. Never strips when the line can feed an interpreter (| sh,`,
+        `# iex, eval, xargs, base64 -d, -EncodedCommand) and keeps any region that`,
+        `# interpolates $( ) or backtick pairs — those execute BEFORE the command.`,
+        `function global:Get-FcdExecView {`,
+        `  param([string]$CommandLine)`,
+        String.raw `  if ($CommandLine -match '(?i)\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b') { return $CommandLine }`,
+        `  $out = $CommandLine`,
+        "  $keepIfInterpolates = [System.Text.RegularExpressions.MatchEvaluator]{ param($m) if ($m.Value -match '\\$\\(|" + '`[^`]*`' + "') { $m.Value } else { ' fcd_inert_data ' } }",
+        String.raw `  $out = [regex]::Replace($out, "@'[\s\S]*?'@", ' fcd_inert_data ')`,
+        `  $out = [regex]::Replace($out, '@"[\\s\\S]*?"@', $keepIfInterpolates)`,
+        String.raw `  $out = [regex]::Replace($out, "<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)", ' fcd_inert_data ')`,
+        String.raw `  $out = [regex]::Replace($out, '<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)', $keepIfInterpolates)`,
+        String.raw `  $flagArg = '((?:^|\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\s*)("(?:[^"\\]|\\.)*"|''(?:[^''\\]|\\.)*'')'`,
+        "  $out = [regex]::Replace($out, $flagArg, [System.Text.RegularExpressions.MatchEvaluator]{ param($m) if ($m.Groups[2].Value.StartsWith(\"'\")) { $m.Groups[1].Value + ' fcd_inert_data ' } elseif ($m.Groups[2].Value -match '\\$\\(|" + '`[^`]*`' + "') { $m.Value } else { $m.Groups[1].Value + ' fcd_inert_data ' } }, 'IgnoreCase')",
+        `  return $out`,
+        `}`,
+        ``,
         `function global:Test-FcdShellGuard {`,
         `  param([string]$CommandLine)`,
         `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
         `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
+        `  $execView = $CommandLine`,
+        `  try { $execView = Get-FcdExecView -CommandLine $CommandLine } catch { }`,
+        `  $execNormalized = ($execView -replace '\\s+', ' ').Trim()`,
         `  $warnHit = $null`,
         `  foreach ($rule in $global:FcdGuardRules) {`,
         `    try {`,
-        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) {`,
+        `      # Built-in rules ask "can this text ACT?" — they see the execution`,
+        `      # view, so a commit message quoting a dangerous command is inert.`,
+        `      # Console custom rules define their own scope — they see the raw line.`,
+        `      $isCustom = ([string]$rule.Source -eq 'custom')`,
+        `      $target = if ($isCustom) { $CommandLine } else { $execView }`,
+        `      $targetNorm = if ($isCustom) { $normalized } else { $execNormalized }`,
+        `      if ($rule.Regex.IsMatch($targetNorm) -or $rule.Regex.IsMatch($target)) {`,
         `        # A block rule always outranks a warn rule matching the same line.`,
         `        if ($rule.Action -ne 'warn') { return $rule }`,
         `        if ($null -eq $warnHit) { $warnHit = $rule }`,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.25.2"
+  "version": "1.25.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.25.2",
+  "version": "1.25.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {